{"record":{"id":"4dbde3c0161cead7","repo":"tailscale/tailscale","slug":"failed-to-list-proxygroup-q-state-secrets-w","errorCode":null,"errorMessage":"failed to list ProxyGroup %q state Secrets: %w","messagePattern":"failed to list ProxyGroup %q state Secrets: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/k8s-operator/ingress-for-pg.go","lineNumber":849,"sourceCode":"\t\t\tmak.Set(&secret.Data, fileName, confB)\n\t\t\tupdated = true\n\t\t}\n\n\t\tif updated {\n\t\t\tif err := r.Update(ctx, &secret); err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating ProxyGroup config Secret: %w\", err)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc numberPodsAdvertising(ctx context.Context, cl client.Client, tsNamespace, pgName string, serviceName string) (int, error) {\n\t// Get all state Secrets for this ProxyGroup.\n\tsecrets := &corev1.SecretList{}\n\tif err := cl.List(ctx, secrets, client.InNamespace(tsNamespace), client.MatchingLabels(pgSecretLabels(pgName, kubetypes.LabelSecretTypeState))); err != nil {\n\t\treturn 0, fmt.Errorf(\"failed to list ProxyGroup %q state Secrets: %w\", pgName, err)\n\t}\n\n\tvar count int\n\tfor _, secret := range secrets.Items {\n\t\tprefs, ok, err := getDevicePrefs(&secret)\n\t\tif err != nil {\n\t\t\treturn 0, fmt.Errorf(\"error getting node metadata: %w\", err)\n\t\t}\n\t\tif !ok {\n\t\t\tcontinue\n\t\t}\n\t\tif slices.Contains(prefs.AdvertiseServices, serviceName) {\n\t\t\tcount++\n\t\t}\n\t}\n\n\treturn count, nil\n}","sourceCodeStart":831,"sourceCodeEnd":867,"githubUrl":"https://github.com/tailscale/tailscale/blob/cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042/cmd/k8s-operator/ingress-for-pg.go#L831-L867","documentation":"Returned when the Kubernetes client cannot List the ProxyGroup's state Secrets (label selector pgSecretLabels(pgName, LabelSecretTypeState)) in the operator namespace. numberPodsAdvertising uses this list to count replicas advertising the Ingress's Service, so the count cannot be computed. Typical causes are RBAC denials, apiserver errors, or transient network failure between operator and control plane.","triggerScenarios":"cl.List(ctx, secrets, client.InNamespace(tsNamespace), client.MatchingLabels(...)) while reconciling an HA Ingress whose ProxyGroup replicas should be counted. Fires on: missing list permission on secrets in tsNamespace; apiserver unavailable; an invalid label key/value in pgSecretLabels (should not happen with current code).","commonSituations":"Operator installed with a narrowed ClusterRole; operator namespace mismatch after helm re-install; control plane briefly unavailable during upgrade; ProxyGroup never started so labels differ (usually yields empty list, not an error).","solutions":["Check the wrapped error status: 403 means RBAC — restore the operator's secret list permissions","kubectl get secrets -n <operator-ns> -l tailscale.com/parent-proxy-group=<pgName> to confirm the selector and namespace are correct","If transient (5xx/timeout), wait for the automatic requeue before taking further action","Confirm the operator is watching the namespace where ProxyGroup state Secrets actually live"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := cl.List(ctx, secrets, client.InNamespace(ns), client.MatchingLabels(labels)); err != nil {\n    if apierrors.IsForbidden(err) {\n        // permanent config problem: surface loudly, do not hot-loop\n        return 0, fmt.Errorf(\"RBAC denies listing ProxyGroup state Secrets: %w\", err)\n    }\n    return 0, fmt.Errorf(\"failed to list ProxyGroup state Secrets: %w\", err)\n}","preventionTips":["Install the operator with its bundled ClusterRole; never hand-trim secret list permissions","Pin the operator namespace so state Secret selection stays stable across re-installs","Monitor reconcile_error_total in operator metrics to catch permission drift early"],"tags":["kubernetes","operator","secrets","rbac","list"],"backgroundTag":null,"analyzedSha":"cfe32b8be6a33f8e24fbc369cbfbf7c729d9e042","analyzedAt":"2026-08-15T19:58:31.583Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}